CVE-2023-3749

Directly requires independent verification of matching output before adverse decisions, mitigating insufficient authenticity checks on data from external sources.

Use of approved PKI certificates provides verifiable data authenticity and origin for communications and artifacts.

Mandates provision of authenticity and integrity artifacts that enable verification of name/address resolution data.

Requires explicit verification of data authenticity from authoritative sources, preventing acceptance of unauthenticated resolution responses.

Control requires verification of data authenticity/integrity (e.g., checksums) after aggregation/packing, directly reducing exploitation of insufficient verification before transmission.

Time synchronization supports reliable freshness verification when checking data authenticity across systems or components.

Mandates verification of data authenticity for software, firmware, and information.

Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.

Cryptographic integrity checks on data-at-rest can detect tampering or substitution of untrusted content mixed with trusted data.

Cryptographic integrity mechanisms on data-in-transit can prevent acceptance of extraneous untrusted data by validating origin and detecting modification.

Secure SDLC practices directly address proper trust-boundary enforcement and input validation, preventing this class of weakness during development.

A.8.24's guidance on identifying protection levels, selecting algorithms/strength for authenticity/integrity (items b,f), using cryptography for transmitted/stored data (c), and key management directly stops many CWE-345 exploits by ensuring verifiable authenticity; however, it leaves a bounded remainder where verification logic itself is flawed or absent (e.g. accepting unverified signatures or weak schemes), as the control depends on correct implementation in other mechanisms.

Secure development lifecycle mandates input validation and trust-boundary enforcement that directly prevents acceptance of untrusted data alongside trusted data.

Application security requirements explicitly call for strict separation and validation of trusted versus untrusted data sources.

A.8.27 mandates security-by-design principles including distrust-external-input, data validation/sanitization, least privilege and security-oriented design reviews that can stop extraneous untrusted data from being treated as trusted, but this is only one slice of a weakness whose dominant causes sit in implementation and in specific input-handling code that the high-level engineering principles do not themselves enforce.

Secure coding standards mandate input sanitization and provenance checks that prevent acceptance of extraneous untrusted data.